mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-26 22:20:59 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,60 @@
|
||||
# Standards and References - Authenticated Scanning with OpenVAS
|
||||
|
||||
## Primary Standards
|
||||
|
||||
### NIST SP 800-115
|
||||
- **Title**: Technical Guide to Information Security Testing and Assessment
|
||||
- **URL**: https://csrc.nist.gov/publications/detail/sp/800-115/final
|
||||
- **Relevance**: Defines vulnerability scanning methodologies including credentialed vs non-credentialed approaches
|
||||
|
||||
### NIST SP 800-53 Rev 5 - RA-5
|
||||
- **Title**: Vulnerability Monitoring and Scanning
|
||||
- **URL**: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
|
||||
- **Requirement**: Organizations must scan for vulnerabilities in information systems and hosted applications with both authenticated and unauthenticated methods
|
||||
|
||||
### CIS Controls v8 - Control 7
|
||||
- **Title**: Continuous Vulnerability Management
|
||||
- **URL**: https://www.cisecurity.org/controls/continuous-vulnerability-management
|
||||
- **Sub-controls**:
|
||||
- 7.1: Establish and maintain a vulnerability management process
|
||||
- 7.4: Perform authenticated vulnerability scanning with agents or credentialed scans
|
||||
- 7.5: Perform automated vulnerability scans of internal enterprise assets on a quarterly basis
|
||||
|
||||
### PCI DSS v4.0 - Requirement 11.3
|
||||
- **Title**: External and Internal Vulnerabilities Are Regularly Identified, Prioritized, and Addressed
|
||||
- **Requirement**: Internal vulnerability scans must be performed at least quarterly and after any significant change; authenticated scanning is required for comprehensive assessment
|
||||
|
||||
## OpenVAS/GVM Technical References
|
||||
|
||||
### Greenbone Community Edition
|
||||
- **URL**: https://greenbone.github.io/docs/latest/
|
||||
- **Components**: gvmd (manager), openvas-scanner, gsad (web UI), ospd-openvas
|
||||
- **Feed**: Greenbone Community Feed with 180,000+ NVT checks
|
||||
|
||||
### GVM Architecture
|
||||
- **Scanner**: openvas-scanner performs the actual vulnerability tests
|
||||
- **Manager**: gvmd manages scan tasks, credentials, targets, and results
|
||||
- **Web Interface**: Greenbone Security Assistant (GSA) provides browser-based management
|
||||
- **Database**: PostgreSQL stores configurations and results
|
||||
- **Cache**: Redis provides high-speed NVT metadata caching
|
||||
|
||||
### python-gvm Library
|
||||
- **URL**: https://github.com/greenbone/python-gvm
|
||||
- **PyPI**: https://pypi.org/project/python-gvm/
|
||||
- **Documentation**: https://python-gvm.readthedocs.io/
|
||||
|
||||
### GMP Protocol
|
||||
- **Title**: Greenbone Management Protocol
|
||||
- **URL**: https://docs.greenbone.net/API/GMP/gmp-22.04.html
|
||||
- **Purpose**: XML-based protocol for programmatic interaction with gvmd
|
||||
|
||||
## Compliance Mapping
|
||||
|
||||
| Framework | Control | Authenticated Scan Requirement |
|
||||
|-----------|---------|-------------------------------|
|
||||
| NIST 800-53 | RA-5 | Credentialed scanning for host-level assessment |
|
||||
| PCI DSS 4.0 | 11.3.1 | Internal vulnerability scanning quarterly |
|
||||
| CIS Controls v8 | 7.4 | Authenticated vulnerability scanning |
|
||||
| ISO 27001 | A.8.8 | Technical vulnerability management |
|
||||
| HIPAA | 164.312(a)(1) | Technical safeguards evaluation |
|
||||
| SOC 2 | CC7.1 | Vulnerability identification and remediation |
|
||||
@@ -0,0 +1,86 @@
|
||||
# Workflows - Authenticated Scanning with OpenVAS
|
||||
|
||||
## Workflow 1: Initial Authenticated Scan Setup
|
||||
|
||||
### Steps
|
||||
1. **Install and initialize GVM**
|
||||
- Install GVM packages or deploy Docker containers
|
||||
- Run `gvm-setup` to initialize database and create admin account
|
||||
- Verify all services with `gvm-check-setup`
|
||||
|
||||
2. **Synchronize vulnerability feeds**
|
||||
- Run `greenbone-feed-sync` for NVT, SCAP, and CERT data
|
||||
- Wait for initial sync to complete (15-30 minutes)
|
||||
- Verify feed status in GSA dashboard
|
||||
|
||||
3. **Create scan credentials**
|
||||
- Create SSH key pair for Linux scanning: `ssh-keygen -t ed25519 -f scan_key`
|
||||
- Deploy public key to target hosts: `ssh-copy-id -i scan_key.pub scan_user@target`
|
||||
- Create Windows service account with local admin rights for SMB scanning
|
||||
- Import credentials into GVM via GSA or gvm-cli
|
||||
|
||||
4. **Define scan targets**
|
||||
- Group hosts by OS type and credential type
|
||||
- Assign appropriate credentials to each target group
|
||||
- Configure alive test method (ICMP + TCP-ACK recommended)
|
||||
|
||||
5. **Select scan configuration**
|
||||
- Use "Full and fast" for production environments
|
||||
- Use "Full and deep" for pre-production/staging
|
||||
- Clone and customize for specific compliance requirements
|
||||
|
||||
6. **Execute initial scan**
|
||||
- Create scan task linking target, config, and schedule
|
||||
- Run scan during maintenance window for first execution
|
||||
- Monitor progress through GSA dashboard
|
||||
|
||||
7. **Validate authentication success**
|
||||
- Check report for authentication NVT results
|
||||
- Verify SSH/SMB login success indicators
|
||||
- Compare finding count against unauthenticated baseline
|
||||
|
||||
## Workflow 2: Recurring Authenticated Scan
|
||||
|
||||
### Trigger
|
||||
Weekly schedule (Sunday 2:00 AM UTC).
|
||||
|
||||
### Steps
|
||||
1. GVM automatically starts scheduled scan task
|
||||
2. Scanner performs alive detection on all target hosts
|
||||
3. For each responding host:
|
||||
- Authenticate using stored credentials
|
||||
- Run all applicable NVT checks
|
||||
- Collect installed package lists, registry keys, configurations
|
||||
4. Results stored in PostgreSQL database
|
||||
5. Compare against previous scan for delta analysis
|
||||
6. Generate report in XML/CSV/PDF format
|
||||
7. Export results to vulnerability management platform (DefectDojo, Jira)
|
||||
|
||||
## Workflow 3: Scan Result Export Pipeline
|
||||
|
||||
### Steps
|
||||
1. Scan completes and report is generated
|
||||
2. Python script fetches report via GMP protocol
|
||||
3. Parse XML results and extract:
|
||||
- CVE identifiers
|
||||
- CVSS scores
|
||||
- Affected hosts and ports
|
||||
- NVT descriptions and remediation guidance
|
||||
4. Transform into standardized format
|
||||
5. Upload to DefectDojo via reimport API
|
||||
6. Create Jira tickets for Critical/High findings
|
||||
7. Update vulnerability SLA tracking database
|
||||
|
||||
## Workflow 4: Credential Rotation
|
||||
|
||||
### Trigger
|
||||
Monthly or upon security policy requirement.
|
||||
|
||||
### Steps
|
||||
1. Generate new SSH key pair or update service account password
|
||||
2. Deploy new credentials to target hosts via configuration management (Ansible, Puppet)
|
||||
3. Update credential objects in GVM
|
||||
4. Run validation scan on subset of targets
|
||||
5. Verify authentication success in validation report
|
||||
6. If successful, update production scan tasks
|
||||
7. Revoke old credentials from target hosts
|
||||
Reference in New Issue
Block a user